feat(#1886): trust a peer hive's root CA hive-wide for self-signed federation

Add swarm.peers.<domain>.caCert (path to a peer hive's root CA PEM),
trusted everywhere the hive's own internal CA is — so a self-signed
peer hive can federate (matrix) and any in-hive consumer validates its
certs.

Mechanism (reuses the existing hive-CA embedding): the meta-flake
renderer embeds a LIST of CA files next to each agent's flake —
hive-ca.pem (the hive's own self-signed CA, when active) plus each peer
caCert as peer-ca-<N>.pem — and emits them all in
security.pki.certificateFiles, so every agent trusts them at build
time. The matrix container trusts the same peer CAs for federation TLS.
Nothing is installed in the host trust store; the certs live in the nix
store (no mutable host file).

- meta.rs: embedded_ca_files() = hive CA + peer CAs (from new
  HIVE_PEER_CA_PATHS env); ca_embed_state() tracks the list (content +
  add/remove); sync_agents materialises + stages the list; render emits
  the multi-entry certificateFiles. Tests cover hive-only / hive+peers
  / peers-only / none.
- hive-c0re.nix: HIVE_PEER_CA_PATHS service env (colon-joined caCerts);
  caCert / certFingerprint option docs updated to the hive-wide scope.
- hive-matrix.nix + docs/swarm.md: scope + comment updates.

certFingerprint stays the c0re-only leaf-pin path.

nix/modules/hive-matrix.nix

@@ -358,6 +358,21 @@ in
         {
           system.stateVersion = "26.05";
 
+          # Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
+          # container's trust bundle so tuwunel validates *federation* TLS
+          # from a self-signed peer hive (it checks the peer's federation
+          # cert against its trust bundle). Peer CAs are trusted everywhere
+          # the hive's own internal CA is — agents get them via the
+          # meta-flake renderer (`HIVE_PEER_CA_PATHS` → each agent's
+          # `security.pki.certificateFiles`); this block is the matrix
+          # container's copy, since the host `security.pki` store doesn't
+          # cross the container boundary. They are never installed in the
+          # HOST trust store. Null entries (CA-bundle / fingerprint-pinned
+          # peers) drop out.
+          security.pki.certificateFiles = lib.filter (c: c != null) (
+            lib.mapAttrsToList (_domain: p: p.caCert) config.services.hyperhive.swarm.peers
+          );
+
           # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
           # `nameserver` line (`Failed to configure DNS resolver ... no
           # nameservers found in config` → exit 1). This declarative